After the v4.6.32 refactor that added the PRAISONAI_ALLOW_LOCAL_TOOLS environment variable gate to tool_override.py, PraisonAI still had two unguarded spec.loader.exec_module calls in agents_generator.py. These calls accept a module_path parameter sourced from YAML configuration and execute it without validation, signature checking, or the env‑var gate. The lack of validation allows an attacker to run arbitrary Python code, compromising confidentiality, integrity, and availability of the system. The weakness is a direct code execution flaw, corresponding to CWE-829 and CWE-94.

The vulnerability affects MervinPraison PraisonAI versions before 4.6.40. The 4.6.32 chokepoint refactor added a gate for tool overrides, but did not cover the two exec_module sites in agents_generator.py. Users running any release older than 4.6.40 are at risk.

The CVSS score of 8.1 indicates high severity. The EPSS score of less than 1% suggests a low probability of exploitation at the time of this analysis, and the vulnerability is not listed in CISA’s KEV catalog. The attack likely requires the ability to influence the YAML configuration that specifies the module_path, so the vector is inferred to be local or mediated. Even so, the impact is complete arbitrary code execution once the flaw is triggered.